Malware Analysis Report

2025-08-05 17:02

Sample ID 240107-yax84scffp
Target a5f1f3c0e9c140039e13efc40d4c4b91.exe
SHA256 5ac67e6c5415b14889c40a906b82d8aae678d396122931b9de5fe39ac50526b1
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5ac67e6c5415b14889c40a906b82d8aae678d396122931b9de5fe39ac50526b1

Threat Level: Known bad

The file a5f1f3c0e9c140039e13efc40d4c4b91.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visibility of file extensions in Explorer

Blocks application from running via registry modification

Sets file execution options in registry

Loads dropped DLL

Executes dropped EXE

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Runs regedit.exe

Suspicious use of SetWindowsHookEx

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 19:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 19:35

Reported

2024-01-07 19:38

Platform

win7-20231215-en

Max time kernel

151s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\regedit.exe N/A

Blocks application from running via registry modification

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" C:\Windows\SysWOW64\regedit.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Windows\SysWOW64\regedit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\KavUpda.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\Autorun.inf C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Autorun.inf C:\Windows\system\KavUpda.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Option.bat C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\SysWOW64\Option.bat C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Windows\SysWOW64\Folderdir C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\KavUpda.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\system\KavUpda.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File created C:\Windows\Help\HelpCat.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\Help\HelpCat.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\Sysinf.bat C:\Windows\system\KavUpda.exe N/A
File created C:\Windows\Sysinf.bat C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File created C:\Windows\regedt32.sys C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\system\KavUpda.exe C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Windows\regedt32.sys C:\Windows\system\KavUpda.exe N/A
File created C:\Windows\regedt32.sys C:\Windows\system\KavUpda.exe N/A

Runs net.exe

Runs regedit.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
N/A N/A C:\Windows\system\KavUpda.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2824 wrote to memory of 3044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2824 wrote to memory of 3044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2824 wrote to memory of 3044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2824 wrote to memory of 3044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2076 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 2076 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 2076 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 2076 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 2076 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 2076 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 2076 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 2076 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 2076 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 2704 wrote to memory of 2148 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2704 wrote to memory of 2148 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2704 wrote to memory of 2148 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2704 wrote to memory of 2148 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2592 wrote to memory of 2552 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2592 wrote to memory of 2552 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2592 wrote to memory of 2552 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2592 wrote to memory of 2552 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2568 wrote to memory of 1980 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2568 wrote to memory of 1980 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2568 wrote to memory of 1980 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2568 wrote to memory of 1980 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2884 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2884 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2884 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2884 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2748 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2748 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2748 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2748 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe

"C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start schedule /y

C:\Windows\SysWOW64\net.exe

net.exe start schedule /y

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\system32\Option.bat

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\at.exe

at 7:37:49 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config wscsvc start= disabled

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config SharedAccess start= disabled

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\regedit.exe

regedit.exe /s C:\Windows\regedt32.sys

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\at.exe

at 7:40:49 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:40:49 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:37:49 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\At.exe

At.exe 7:38:46 PM C:\Windows\Help\HelpCat.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\system32\Option.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start schedule /y

C:\Windows\SysWOW64\net.exe

net.exe start schedule /y

C:\Windows\system\KavUpda.exe

C:\Windows\system\KavUpda.exe

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\at.exe

at 7:37:53 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\at.exe

at 7:40:53 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:40:53 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:37:53 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\At.exe

At.exe 7:38:51 PM C:\Windows\Help\HelpCat.exe

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config wscsvc start= disabled

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config SharedAccess start= disabled

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-134018529-566270021138844997315451417291452563073-70895558416432995171467065660"

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1001302706-17952176731979169229-1212520874117334883951869841410012199931951374839"

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-111485589330823409719888946791703084344937367063-1374637256767676924-666231563"

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-937999055-7199825307226760001564440601-982204284-13335861872104809943-42110759"

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

Network

N/A

Files

memory/2076-0-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Windows\SysWOW64\Option.bat

MD5 3f7fbd2eb34892646e93fd5e6e343512
SHA1 265ac1061b54f62350fb7a5f57e566454d013a66
SHA256 e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA512 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

C:\Windows\system\KavUpda.exe

MD5 b4a0e673f2ed7b5aa1977b0e8149ac2c
SHA1 035018c5245f88c3e129a5f7bb029ebda37189f5
SHA256 c236f9edb65d20989641da3c754af475c5beb418f639131d115790ac1af516c6
SHA512 7bea49d765669520b5b62a80961a7c12f8f8645f5003c3c8efd4a81279cc53935c909fd767cd4b7369f137bf3635da80394aa627b3f125a3493c540958b5584d

C:\Windows\regedt32.sys

MD5 e7d7ec66bd61fac3843c98650b0c68f6
SHA1 a15ae06e1be51038863650746368a71024539bac
SHA256 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512 ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

\Windows\system\KavUpda.exe

MD5 b8b3c3db3bd785f41a9ce41f8971116e
SHA1 6c7843721044e16681be12b3a494a61f24415fc3
SHA256 4614d5ba4d3b1c94e9ec53afd2e60c20f38459397fcf3a303c18bebbeefa0624
SHA512 549829d487139c73c9c8e6ca4fe62cf9950e4f426d552c71aeb17880e87b56af8d9a6c971164821007ef3299071365d0c121b841f905e228d703c0737197b55c

C:\Windows\system\KavUpda.exe

MD5 d2ccbefaf09ebeae577e76643c1746e4
SHA1 e8a1f5dc7823e37ff851e5e8b44d47abfda791f0
SHA256 cf2719049097953d73dec546bfe5cf622ed26e0f10d7ee8645c1ee31a5db34af
SHA512 fda92b12d390a65a315204cab7302f7d6cf1f3da40b8fc06111f4d5b10870dcb4c240d133d49e44f05aa0242536ceabeaf5195a38153a893e5dd56f48a7387be

C:\Windows\system\KavUpda.exe

MD5 896d2a43af4708e0c1382ae3db43e146
SHA1 5e236edc09b2d0eff4a28ff3efa757574028ce3b
SHA256 f2978d0c4c06429b5bf76cc59c3cfe555d9b1eaedfe4970e3eb7bd9a2586d8c7
SHA512 7a735bdcd7917e6416c8881a97612f0a2571f126ce5a20af1c577e6dfe5dcce1f4777dc14f480b0745d2cceb13fa278810ac0b49adb1728a31fa802a8f6cda75

\Windows\system\KavUpda.exe

MD5 312e4dbc41e00550c4eaa4cf2f051c30
SHA1 dc10fb8c5715712a9c4793ce853c94df43fcc2ce
SHA256 9d6a428522329504296a384e39090a4163d1a40733220c928d0a5cbcff43788f
SHA512 216c1f8bec3071a59235f5bf98be634c72820807fff1b4ea4182b94961b40ec4b967c08108dc1545c573f72abd1ca20053b6b15ccd448fcbdebea50d10270ec7

C:\Windows\Sysinf.bat

MD5 7db3d565d6ddbe65a8b0e093910e7dcd
SHA1 d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256 a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA512 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

F:\Autorun.inf

MD5 94bcd02c5afd5918b4446345e7a5ded9
SHA1 79839238e84be225132e1382fae6333dfc4906a1
SHA256 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 19:35

Reported

2024-01-07 19:38

Platform

win10v2004-20231215-en

Max time kernel

164s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\regedit.exe N/A

Blocks application from running via registry modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" C:\Windows\SysWOW64\regedit.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe C:\Windows\SysWOW64\regedit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\KavUpda.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\Autorun.inf C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Autorun.inf C:\Windows\system\KavUpda.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Option.bat C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\SysWOW64\Option.bat C:\Windows\system\KavUpda.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\KavUpda.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File created C:\Windows\Sysinf.bat C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\system\KavUpda.exe C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Windows\Sysinf.bat C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Windows\regedt32.sys C:\Windows\system\KavUpda.exe N/A
File created C:\Windows\regedt32.sys C:\Windows\system\KavUpda.exe N/A
File opened for modification C:\Windows\system\KavUpda.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File created C:\Windows\Help\HelpCat.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File opened for modification C:\Windows\Help\HelpCat.exe C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
File created C:\Windows\regedt32.sys C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Runs net.exe

Runs regedit.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system\KavUpda.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system\KavUpda.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe N/A
N/A N/A C:\Windows\system\KavUpda.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 812 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 4848 wrote to memory of 1468 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4848 wrote to memory of 1468 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4848 wrote to memory of 1468 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 812 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 812 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 812 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\At.exe
PID 812 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\System32\Conhost.exe
PID 812 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\System32\Conhost.exe
PID 812 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\System32\Conhost.exe
PID 812 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\net.exe
PID 812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 812 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 812 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\attrib.exe
PID 812 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\sc.exe
PID 812 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\regedit.exe
PID 812 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\regedit.exe
PID 812 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\regedit.exe
PID 2600 wrote to memory of 1272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\System32\Conhost.exe
PID 2600 wrote to memory of 1272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\System32\Conhost.exe
PID 2600 wrote to memory of 1272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\System32\Conhost.exe
PID 1660 wrote to memory of 1628 N/A C:\Windows\System32\Conhost.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1628 N/A C:\Windows\System32\Conhost.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1628 N/A C:\Windows\System32\Conhost.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 2092 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 2092 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 2092 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 812 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\system32\svchost.exe
PID 812 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\system32\svchost.exe
PID 812 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\system32\svchost.exe
PID 812 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\reg.exe
PID 812 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\reg.exe
PID 812 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe C:\Windows\SysWOW64\reg.exe
PID 1836 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe

"C:\Users\Admin\AppData\Local\Temp\a5f1f3c0e9c140039e13efc40d4c4b91.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start schedule /y

C:\Windows\SysWOW64\net.exe

net.exe start schedule /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\regedit.exe

regedit.exe /s C:\Windows\regedt32.sys

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\at.exe

at 7:41:20 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\at.exe

at 7:38:20 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config wscsvc start= disabled

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config SharedAccess start= disabled

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:41:20 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:38:20 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\At.exe

At.exe 7:39:18 PM C:\Windows\Help\HelpCat.exe

C:\Windows\SysWOW64\net.exe

net.exe start schedule /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start schedule /y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat

C:\Windows\system\KavUpda.exe

C:\Windows\system\KavUpda.exe

C:\Windows\SysWOW64\at.exe

at 7:38:25 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\at.exe

at 7:41:25 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config wscsvc start= disabled

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config SharedAccess start= disabled

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe config srservice start= disabled

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop srservice /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv /y

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop 360timeprot /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sharedaccess /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wscsvc /y

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f

C:\Windows\SysWOW64\net.exe

net.exe stop 360timeprot /y

C:\Windows\SysWOW64\net.exe

net.exe stop srservice /y

C:\Windows\SysWOW64\net.exe

net.exe stop wuauserv /y

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\net.exe

net.exe stop sharedaccess /y

C:\Windows\SysWOW64\net.exe

net.exe stop wscsvc /y

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:41:25 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c at 7:38:25 PM C:\Windows\Sysinf.bat

C:\Windows\SysWOW64\At.exe

At.exe 7:39:23 PM C:\Windows\Help\HelpCat.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir F:\Autorun.inf /s /q

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r F:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\cmd.exe

cmd /c rmdir C:\Autorun.inf /s /q

C:\Windows\SysWOW64\cmd.exe

cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d

C:\Windows\SysWOW64\attrib.exe

attrib -s -h -r C:\Autorun.inf\*.* /s /d

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 18.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp

Files

memory/812-0-0x0000000000400000-0x0000000000436000-memory.dmp

C:\Windows\System\KavUpda.exe

MD5 5ee627d8ccdc9935b23a88ad815fc678
SHA1 78631be947d2efba49505939ef48a438aa607ead
SHA256 e395d59a1fd19d3ccb8d86df75f0ac3639fea2d088679631efb8670bb698affc
SHA512 140f9509f0ba8b31a3df9547df1d19c865a543b063a26ff49c3bb9d2674043f6236995d2059706e3eafbb481d0bd9fdb11fbbc2899c75588c5b81deb8a5ed0d4

C:\Windows\SysWOW64\Option.bat

MD5 3f7fbd2eb34892646e93fd5e6e343512
SHA1 265ac1061b54f62350fb7a5f57e566454d013a66
SHA256 e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA512 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

C:\Windows\regedt32.sys

MD5 e7d7ec66bd61fac3843c98650b0c68f6
SHA1 a15ae06e1be51038863650746368a71024539bac
SHA256 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512 ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

C:\Windows\system\KavUpda.exe

MD5 a5f1f3c0e9c140039e13efc40d4c4b91
SHA1 4478feb58ee80f702cd6d1480d85439d450a62c7
SHA256 5ac67e6c5415b14889c40a906b82d8aae678d396122931b9de5fe39ac50526b1
SHA512 530d14efdc973759fd2a0129b39129e5fc24e1a0bb9117fa856d91b608cfa0e0923e2cf184cd462e4a0d9e4d5f5e7bf5443c5d1513dbe6da7a6e69dcfe0d79f6

C:\Windows\Sysinf.bat

MD5 7db3d565d6ddbe65a8b0e093910e7dcd
SHA1 d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256 a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA512 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

F:\Autorun.inf

MD5 94bcd02c5afd5918b4446345e7a5ded9
SHA1 79839238e84be225132e1382fae6333dfc4906a1
SHA256 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500